Space Rescue 

Space Rescue has been a topic of speculation for a wide community of people for 
decades. Astronauts, aerospace engineers, diplomats, medical and rescue professionals, 
inventors and science fiction writers have all speculated on this problem. Martin Caidin’s 
1964 novel “Marooned” dealt with the problems of rescuing a crew stranded in low earth 
orbit. Legend at the Johnson Space Center says that Caidin’s portrayal of a Russian 
attempt to save the American crew played a pivotal role in convincing the Russians to 
join the real joint Apollo-Soyuz mission. Space Rescue has been a staple in science 
fiction television and movies portrayed in programs such as Star Trek, Stargate-SGl 
and Space 1999 and movies such as Mission To Mars and Red Planet. As dramatic and 
as difficult as rescue appears in fictional accounts, in the real world it has even greater 
drama and greater difficulty. 

Space rescue is still in its infancy as a discipline and the purpose of this chapter is to 
describe the issues associated with space rescue and the work done so far in this field. For 
the purposes of this chapter, the term space rescue will refer to any system which allows 
for rescue or escape of personnel from situations which endanger human life in a 
spaceflight operation. This will span the period from crew ingress prior to flight through 
crew egress postlanding. For the purposes of this chapter, the term “primary system” will 
refer to the spacecraft system that a crew is either attempting to escape from or from 
which an attempt is being made to rescue the crew. 

Legal and Diplomatic Basis 

Article V of the United Nations Treaty on the Peaceful Uses of Outer Space states 

“States Parties to the Treaty shall regard astronauts as envoys of mankind in outer space 
and shall render to them all possible assistance in the event of accident, distress, or 
emergency landing on the territory of another State Party or on the high seas. When 
astronauts make such a landing, they shall be safely and promptly returned to the State of 
registry of their space vehicle. 

In carrying on activities in outer space and on celestial bodies, the astronauts of one State 
Party shall render all possible assistance to the astronauts of other States Parties. 

States Parties to the Treaty shall immediately inform the other States Parties to the Treaty 
or the Secretary-General of the United Nations of any phenomena they discover in outer 
space, including the moon or other celestial bodies, which could constitute a danger to the 
life or health of astronauts” 

Space Rescue requires attention because spaceflight is currently significantly more 
dangerous than other types of flight 

Development of all space rescue systems eventually turns into a risk versus cost 
discussion. Due to the nature of the technology, space rescue systems are usually 
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complex, expensive and difficult to test. When primary development programs get into 
cost, schedule or technical difficulty, the requirements for space rescue are often 
challenged as they involve significant investment in a system that is intended for use only 
when all of the other aspects of the primary design have failed. It is often argued that 
resources should be used to improve the reliability of the primary system being 
developed to eliminate the need for a rescue system rather than in implementing a 
difficult and costly rescue option. In discussing the necessity for space rescue systems, 
arguments often revolve around an argument utilizing commercial airliner flight. The 
argument is that at one time commercial airliners carried parachutes but that is no longer 
the practice and why should astronaut crews have an escape option that airline passengers 
do not have. Similar arguments have been made regarding the risks associated with flight 
in military transport aircraft and helicopters in a combat zone. 

JSC Safety and Mission Assurance (SMA) recently compared the relative dangers of 
different types of flight. As a relative order of magnitude metric, JSC SMA estimated the 
following risks: 


Risk of loss of life in a commercial 
airplane 

1 in a 1,000,000 flights 

Risk of loss of life in a military aircraft 

1 in 100,000 flights 

Risk of loss of life in combat in a military 
jet aircraft 

1 in 10,000 flights 

Risk of loss of life in human spaceflight 

1 in 100 flights 


At this time, human spaceflight is significantly higher risk than any other type of flight 
and these statistics represent the best counter to the “rescue systems aren’t required” 
argument. This very high risk of human spaceflight is driven by many factors. The 
maturity of the technology is a major contributor. Compared to commercial or military 
aviation, human spaceflight has accumulated relatively few hours of operation and has 
had very few generations to accomplish design evolution of a highly reliable system. 
Space systems also operate in a very demanding environment due to the speeds required 
to reach orbital velocity and the amount of fuel and oxidizer mass required at launch. 

This forces tremendous efficiency in structural design and propulsion efficiency. For 
example, the ta nk wall of shuttle external tank, if scaled down to handheld size would be 
significantly thinner than that of a soda can. The Space Shuttle Main Engine (SSME) is 
one of the most efficient powerplants ever produced by humans. Robert Ryan, the former 
director of Structures at Marshall Space Flight Center, has developed several interesting 
metrics to help people understand the design challenges associated with space launch. He 
compared the horsepower/weight ratio for several different types of engines and the 
comparisons are shown in the table below: 


Engine 

Weight (lbs) 

Horsepower 

Horsepower/weight 

automobile 

370 

200 

0.54 

Indy 5600 Racing 
Engine 

275 

800 

2.91 
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Small Jet Engine 

2890 

52900 

18.3 

Large Jet Engine 

13065 

1950300 

149.3 

Space Shuttle Main 
Engine (SSME) 

7480 

6786981 

907.4 


It is pretty amazing to realize that there are 3 orders of magnitude between a car engine 
and the SSME. There is even a factor of 6x between the SSME and the only comparable 
mass produced engine, a large jet engine ! Mr Ryan further went on to compare 
propulsion power/structural system weight ratio and propellant mass fraction 


System 

Propulsion Power/System 
Dry Weight 

Propellant Mass Fraction 

Automobile 1995 Mustang 

40.5 

<.l 

Commercial Airliner (747 
and 737) 

326.8 

.4 

Apollo Saturn 

76,700 

.9 


Mr Ryan points out that if an automobile was designed at the same propulsion 
power/structural weight ratio would only weigh 2.5 lbs ! Spaceflight systems clearly 
operate at the extreme end of human design capability for both propulsion and structures 
in a highly demanding environment. 

The spaceflight environment contains many hazards that are not present in the terrestrial 
environment. The crew must be protected from the vacuum of space and many materials 
perform differently at vacuum than at sea level pressure. The crew must be protected 
from extremes of temperature present on orbit. It is not unusual to have a 400 degree 
Fahrenheit environmental gradient within a few inches when transitioning from full 
sunlight to full shadow. The aerodynamic loads on the vehicle during ascent can be large, 
between 700 and 800 pounds per square foot on the shuttle during ascent. The heating 
and aerodynamic loads during entry are equally severe with aerodynamic loads of nearing 
500 pounds per square foot while temperatures can range near 2800 degrees F. These 
combined environment stresses are unique to the aerospace environment. On orbit there 
are unique environmental hazards due to the lack of atmospheric protection such as solar 
radiation and Micrometeoroid Orbital Debris (MMOD). Several space shuttle outer 
windows and thermal radiators have suffered impact damage from MMOD. 


Perhaps one of the most difficult things about dealing with these extreme performance 
requirements and hazardous environments is the relatively few times engineers can take 
advantage of lessons learned by the opportunity to in building a new design. Most of the 
hardware in both the US and Russian programs represents a slow evolution of design. In 
the United States, opportunities to design and test new human space vehicles have been 
separated by large amounts of time. 
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Aerospace engineers also struggle with the fact that even on the rare occasion of 
development of a new system, it is very hard to ground test such systems in the 
laboratory because of the “combined environments” problem. It is almost impossible to 
test designs with all of the loading factors on a design simultaneously as they are applied 
inflight. Aerospace engineers are most often forced to observe the performance of their 
design in one loading environment at a time, whether temperature, inertial loads, 
aerodynamic loads or vibration and then combine the loads through computer modeling 
to ascertain the adequacy of their designs. 

Unlike aviation, spaceflight provides very few opportunities for buildup testing. In an 
aircraft development program, an aircraft is first flown at lower dynamic pressures and 
Mach numbers and the aircraft is monitored for perfonnance. The allowable flight 
envelope is slowly expanded as test data map to preflight predictions. This can occur over 
a sequence of perhaps 100 flights. This is very hard to do in space systems as most space 
systems operate in an “all or nothing” environment. Once a new space system is 
launched, it usually has to go through its entire flight envelope the first time. This, along 
with the combined environments test problem, explains why so many new rocket systems 
fail on their first flight attempt where this type of first flight failure is now almost 
unknown in the aircraft industry. It is worth pointing out that the first space shuttle went 
supersonic 60 seconds into its first flight. It went hypersonic 2 minutes after that. There 
was no opportunity to look at the data, decide that things weren’t as expected and then 
return to base for a quiet examination of the flight performance. 

Given the high costs of current spaceflight systems, there are also very few opportunities 
to perfonn dedicated test flights. Unlike an aircraft certification program, which cannot 
practically be performed in a new aircraft in under a hundred flights, space systems are 
routinely declared operational after one or two flights. As such, space systems have to 
perform the majority of their certification through model predictions of performance 
followed by validation of models by monitoring flight perfonnance in a limited number 
of flights. 

Due to the hostile environment that human spaceflight must operate in, the high 
performance required in space vehicles and the limited opportunities for new 
development and test of these vehicles, human spaceflight will remain the riskiest mode 
of human flight for many years to come. Given this is the case, it is important to 
understand and consider rescue in all phases of human spaceflight. 

Rescue Modes and Probabilities 

The probability of crew survival in a space system with a rescue capability can be 
computed from the equation 


P 


crewsurvival 
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Which is equivalent to 
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From these equations it can be seen that the primary value of a rescue system from the 
perspective of crew survival is that it enables a higher probability of crew survival 
without having to drive higher levels of reliability into the primary system. Reliability is 
usually a major cost driver in systems development. A system with a .99 reliability is 
usually significantly more expensive than a system with .9 reliability. The cost increase 
associated with increasing system reliability from .99 to .999 is usually even higher in 
tenns of percentage of system cost associated with increased reliability. It can be seen 
from these equations that the probability of crew survival with a system, for example, 
with a .9 reliability can be increased to .99 by employing a rescue system of .9 
reliability. 

This type of increase is particularly critical when trying to achieve high reliability rates 
for vehicles with long mission lifetime. In these types of vehicles it is very hard to 
engineer in high levels of reliability due to the effect of extended mission duration rate on 
probability of failure. If the failure rate of components is expressed in failures/unit time, 
then the failure probability is 


1.0 - e ~ 1 ' 

Where X = failure rate/unit time. Using this in an example, consider a system that has a 
part with a Mean Time Between Failures (MTBF) of 500 hours. The following table 
shows the expectation of failure after increasing numbers of hours of operation 


Number of Hours of 
operation 

Probability of failure if 
MTBF = 500 hrs 

Probability of failure if 
MTBF= 1000 hrs 

250 

0.394 

0.221 

500 

0.632 

0.394 

1000 

0.865 

0.632 

5000 

0.99996 

0.993 

10000 

1.0 

0.99996 


It can be seen from this equation that even high reliability components can have difficulty 
meeting high reliability levels when the mission duration is sufficiently long. In these 
cases the normal design strategy is for redundancy and inflight maintenance but this can 
be problematic when the logistics depot is on earth and the operational location is in earth 
orbit or deeper in space. In these cases a rescue system may provide an alternative to 
engineering increasingly higher reliability in the primary system. The addition of a 
rescue/escape system in these types of systems can have a large effect on the probability 
of crew survival. 
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It is interesting to note that the calculation of expectation of crew survival also can be 
used to detennine the effectiveness of a crew escape system in increasing the probability 
of crew survival in a launch system that was not originally designed for high reliability. 
NASA has several times considered the possibility of launching crews on vehicles riding 
atop available expendable launch vehicles. As calculated by JSC Safety and Mission 
Assurance, as of early 2004, the raw reliability of these expendable launch systems 
ranges from .77 to .96. From these calculations it can be shown that a launch abort 
system with even a 90% probability of success can raise the expectation of crew survival 
into the range of .91 to .996 with these expendable launch vehicles. 

At first blush, it may sound as though a launch escape system with a 90% reliability 
shouldn’t be too difficult to develop. However there are many phases of flight where 
abort systems cannot function due to combinations of speed, altitude and dynamic 
pressure. These are called “black zones” and they significantly limit abort/escape 
systems. These are especially limiting when ejection systems are used as crew 
escape/rescue systems. In Gemini and early Space Shuttle, ejection seats were provided 
for crew escape. These had significant limits as to the phase of flight in which they were 
effective. During early shuttle flights during ascent, Mission Control would radio up a 
call to the crew with the words “Negative Seats”. This indicated that speed and altitude 
had reached limits where ejection was no longer possible. It is worth noting that even in 
military jet aircraft, ejection seats only achieve crew survivalin 90% of all ejections and 
in only 95% of cases where ejection occurs within the certified ejection envelope of 
speed and altitude. 

Space flight is a very risky form of flight and rescue/escape systems of reasonable 
reliability can have a major effect on expectation of crew survival but even reasonable 
reliability numbers may be difficult to achieve in the space launch environment. 


Hazards in the different phases of flight 

We will consider the seven primary phases of human spaceflight and the hazards that are 
present there in order to determine the types of rescue and escape systems that might be 
required. 

The seven primary phases of human spaceflight are 


Phase 

Definition 

Prelaunch 

Crew Ingress to liftoff 

Ascent 

Liftoff to achieving orbit 

Orbit 

The phase from achieving orbit to initiating an orbital 
change that results in entry back into the atmosphere. 
This phase could actually include periods of time in a 
transfer from earth orbit to orbit about another body 
such as the moon, an asteroid or another planet 

Rendezvous/ docking/ departure 

The phase from the start of maneuvers to bring two 
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to/from another spacecraft 

spacecraft together, through docking/undocking and 
departure from the other spacecraft 

Descent and ascent from a 
non-terrestrial surface 

This is the time from initiating an orbital change that 
results in a non-terrestrial landing to the time back in a 
stable orbit above a non-terrestrial location. The non- 
terrestrial location could be the moon, an asteroid or 
another planet 

Extra Vehicular Activity 
(EVA) 

the period of time spent outside the spacecraft 

Entry 

the period of time from initiating an orbital change that 
results in atmospheric entry until landing on earth 


The primary, but not inclusive, list of primary hazards during these phases are: 


Phase 

Primary Hazards 

Prelaunch 

Fire or explosion due to systems failure, loss of 
structural integrity, natural environment or propulsion 
related failure 

Ascent 

Systems malfunction, loss of control, loss of structural 
integrity, natural environment induced failure, 
propulsion related failure 

Orbit 

systems failure (explosion, loss of attitude control, loss 
of critical function, toxic material release), natural 
environmental hazard (solar radiation, Micro-Meteoroid 
orbital debris (MMOD)), health issue for the crew 

Rendezvous/ docking/ departure 
to/from another spacecraft 

Collision with another spacecraft, systems failure 
(explosion, loss of attitude control, loss of critical 
function, toxic material release), natural environmental 
hazard (solar radiation, MMOD), health issue for the 
crew, improper targeting or trajectory (off-course) 

Descent and ascent from a 
non-terrestrial surface 

Takeoff or landing related accident due to systems 
malfunction, propulsion malfunction or natural 
environment, improper targeting or trajectory (off- 
course) or surface impact 

Extra Vehicular Activity 

Suit systems malfunction, hole in suit, crew health 
issue, loss of crew connection to spacecraft 
(crewmember adrift - tether protocol lost) 

Entry 

Systems or structural failure, natural environment 
induced failure, loss of control 


Many of the entries in this table are the same for all flight phases. For example 
malfunction in life-critical or mission critical systems can occur in any phase and can be 
catastrophic. Aerospace systems engineers have developed techniques, such as systems 
redundancy, to avoid this type of predicament. Similarly structural failure occurs in all 
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phases. Again aerospace structural engineers have developed techniques, such as defining 
a design limit load and ensuring a factor of safety against that load, which prevent 
failures under anticipated design conditions. In many ways it is the job of a rescue system 
designer to consider design solutions for those scenarios which cannot be anticipated by 
these design techniques. In many cases in order to achieve a practical design solution in 
terms of weight and performance, the design engineer of the primary system must “play 
the odds”. For example, it is often impossible to design a structure capable of 
withstanding the worst case meteoroid impact, or protecting the crew and life critical 
systems in the worst case solar flare. In most cases it is even impossible to develop an in- 
space crew medical facility capable of handling all of the ailments which can arise 
inflight in an otherwise healthy human even with thorough preflight medical screening. 
For these risks which are very hard to evaluate and control, a space rescue system often 
provides the degree of assurance necessary to proceed to flight. 


Historical Distributions of Failures 

David Shaylor’s book, Disasters and Accidents in Manned Spaceflight , has an excellent 
chronology of spacecraft accidents and near-accidents. In reviewing that chronology we 
can separate major events into the 7 phases. Italics indicate fatal accident 


Phase 

Major Historical Incidents 

Prelaunch 

Apollo 1 fire, Soyuz T-10 Abort, Gemini 6 Prelaunch 
Abort, Prelaunch aborts following engine start on 
multiple shuttle flights 

Ascent 

Apollo 12 lightning strike, Soyuz 18-1 Loss of control 
during ascent, Challenger explosion, Columbia debris 
damage, STS-51F engine shutdown and abort to orbit, 
STS-93 electrical short 

Orbit 

Gemini 8 thruster fails on and loses control, Apollo 13 
oxygen tank explodes en route to the moon, Fuel Cell 
failures on STS-2 and Fire onboard Mir, medical 
conditions on multiple Mir flights 

Rendezvous/ docking/ departure 
to/from another spacecraft 

Collision between Mir and Progress resupply vehicle 

Descent and ascent from a 
non-terrestrial surface 

Apollo 10 ascent loss of control during practice landing 
mission 

Extra Vehicular Activity 

Crew helmets fogging (Gemini, Mir), Crew exhaustion 
(Apollo lunar surface) 

Entry 

Soyuz 1 parachute failure, Soyuz 11 decompression, 
Columbia, Soyuz 23 landing in a frozen lake 


In reviewing Shayler’s chronology, the incidents count can be characterized by phase as 
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Phase 

Major Historical Incidents 

Prelaunch/ Ascent 

12/2 fatal 

Orbit/EVA/Rendezvous 

13/0 fatal 

Entry 

10/3 fatal 


This leads to the conclusion that although the risk of incident is pretty much uniform 
through flight, that the risk of fatal accident is largest during the dynamic phases of flight 
of ascent and entry. This maps into the conventionally held wisdom in the aerospace 
industry that the dynamic phases of flight represent the greatest hazard. This is sometimes 
summarized by the adage “the farther the hardware is away from the launch site, the safer 
it is”. This adage summarizes the industry experience that once space hardware is in a 
quiescent state for which it was designed, e.g. the space environment, generally the less 
likely it is to succumb to critical failure. It is interesting to note that even very dramatic 
failures in the space environment (Gemini 8 thruster failed on, Apollo 13 explosion, Mir 
fire and Mir Collision) all represented situations where the crew and ground control were 
able to stabilize a precarious situation and bring the crew home alive. Dynamic flight 
phase incidents generally do not afford the luxury of time and rescue/escape mechanisms 
must be designed in and prepared to go at a moment’s notice as there is usually no time to 
improvise when an incident occurs during these flight phases. 

Historical Rescue Systems 

Given the conventional wisdom and the reality of historical incidents, the development of 
rescue and escape systems reflects an approach to control risk during the dynamic phase 
of flight. Most of the rescue systems for more quiescent phases of flight in the space 
environment are more conceptual and few have proceeded into any hardware 
development stage. 


Phase 

Historical Controls 

Prelaunch 

Rapid pad egress systems (slidewires), launch abort 
rocket systems, ejection seats 

Ascent 

Launch abort rocket systems, ejection seats, intact abort 
modes such as Return To Launch Site, abort to orbit 
modes, bailout systems 

Orbit 

Return vehicle for Skylab, Salyut, Mir, ISS. A variety of 
concepts. 

Rendezvous/ docking/ departure 
to/from another spacecraft 

None other than orbit rescue concepts 

Descent/ascent from a non- 
terrestrial surface 

None - some ability for spacecraft in orbit above the 
nonterrestrial surface to maneuver to rescue the lander 
vehicle if it is in a low orbit 

Extra Vehicular Activity 

Self rescue (secondary oxygen pack), SAFER for 
emergency return of a astronaut adrift 

Entry 

Ejection seat or bailout 
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Prelaunch and Ascent Escape 

Prelaunch and ascent escape concepts have been dominated by escape rockets which lift 
the entire crew module away from the launch vehicle stack. The requirements for these 
systems are driven by two estimates. First what is the warning time of imminent 
explosion and second what is the blast danger radius. The large blast danger area 
associated with most launch vehicles combined with the short to nonexistent warning 
times forces launch escape rockets to be very high thrust with a rapid buildup. Thee 
characteristics along with the desire for storability and low complexity tend to force the 
selection of solid rocket motors for these tasks. 

The Space Shuttle does not have a crew escape rocket system but the addition of a 
winged vehicle added new options for self rescue that were not possible in previous 
launch systems,. This type of self-rescue is called intact aborts. Intact aborts are those 
missions which do not achieve the planned orbital mission yet result in a landing of the 
Space Shuttle Orbiter and crew on a runway. Several classes of intact orbits have been 
defined. The first type of intact abort is an Abort To Orbit (ATO). In an ATO case a 
propulsion malfunction results in reduced engine perfonnance or an engine shutdown. 
Both of these occurred on shuttle mission 51-F on two separate engines. Depending on 
the nature of the malfunction, it may no longer be possible to reach orbit with the 
available propellant so the vehicle is steered to the best orbit achievable. Once this orbit 
is achieved, a plan can be generated to use Orbiter onboard propellant to achieve the 
mission and then deorbit and land or to simply directly deorbit and land. Another intact 
abort is the Abort Once Around (AO A). AOA is a demanding maneuver used for system 
malfunctions which severely limit the ability of the crew to survive. In cases such as loss 
of all cooling or atmospheric pressurization onboard the orbiter during ascent, the crew 
will press to orbit and then immediately deorbit to land at a west coast landing site such 
as Edwards Air Force Base or White Sands Space Harbor in New Mexico. 

Two other dramatic intact abort scenarios exist in which a landing is attempted within 
minutes of launch. The first is nominally designed for a case where a Space Shuttle Main 
Engine shuts down just as the shuttle leaves the pad. In this case it is no longer possible 
to make it to orbit, however it is impossible to really do anything until the two Solid 
Rocket Boosters (SRB) have burned out. So the crew flies past nominal SRB separation 
and then flies a powered trajectory back to the launch site. As the propellant runs down, 
the main engines are shutdown and the External tank is jettisoned in the Atlantic. At that 
point he orbiter glides back to the launch site runway. This intact abort mode, called 
Return to Launch Site (RTLS) is the highest stress case for the shuttle for many of the 
shuttle components and it has never been attempted in actual flight. 

The second intact abort with a rapid landing is a Transatlantic Abort Landing (TAL) or 
East Coast Abort Landing (ECAL). These intact aborts are designed for a propulsion 
malfunction later in flight which does not provide sufficient energy to make orbit but 
which have moved the vehicle far enough downrange that a RTLS is no longer possible. 
In a TAL< the crew flies to a landing in Europe or Africa. In an ECAL, they attempt to 
land at a runway on the east coast of the United States. 
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In the event of a propulsion malfunction such that it is impossible to reach a runway, the 
crew can perform a Contingency Abort. In this mode, the crew flies the best trajectory 
possible to get close to land. Then the engines are shutdown and the External tank is 
jettisoned. The Orbiter is then flown as a glider as close as possible to land. At a specified 
altitude the crew engages an automated routine which flies the orbiter in a straight path 
and the crew bails out. A escape pole is deployed from the side hatch and the crew is 
attached to the pole via a slide. The crew bails out attached to the pole. Sliding along the 
pole allows the crew to reach a position so that when they slide off the end of the pole 
they can avoid re-contact with the shuttle. This capability was added after the Challenger 
accident and is mainly intended to deal with cases where the only alternative is an ocean 
ditching. Although the orbiter shape has been studied and has good ditching 
characteristics, the payload attachments in the payload bay cannot withstand the 
deceleration and the vehicle would be rapidly be tom apart by a loose cargo after water 
impact. The bailout option allows the crew to leave the orbiter before it reaches the 
ocean. The orange Launch Escape Suits (LES) worn by shuttle crews provide them 
physiological support for the high altitude bailout as well as ocean survival capability to 
enable them to survive until they are rescued by recovery forces. 

Orbit Rescue 

The subject of rescue from a stranded vehicle on-orbit has received a lot of concept 
attention over the last 5 decades. This subject is treated in some detail on Mark Wade’s 
www.astronautix.com website. On this site Wade provides the details of 35 different 
concepts for rescue from earth orbit. These concepts generally arise out of two 
paradigms. Orbit rescue concepts based on the “lifeboat” paradigm generally are based 
on a small spacecraft that can act a as a lifeboat to bring the crew home. These vehicles 
struggle with packing crewmembers and spacecraft systems into a small functional 
spacecraft. Another set of rescue concepts are based on the “parachute” paradigm. These 
systems are generally intended for a single crewmember at a time and involve deployable 
systems usually made from inflatable or foam structures and usually involve a parachute 
as the final stage of crew recovery. These systems struggle with implementing structures 
with enough structure to handle re-entry aerodynamic loads (400 pounds per square foot) 
and heating/temperatures (1000-2800 degF) and with sufficient systems to perform the 
deorbit maneuver and maintain life during the entry. 

One exception to this concept work has been the implementation of the Simplified Aid 
For EVA Rescue or SAFER. This is a small compressed nitrogen system that can be 
worn on the bottom of an astronauts life support backpack. This system has thrusters and 
controls which enable the crew member to propel themselves back to the Space Station or 
Space Shuttle if their tether connecting them to the spacecraft is severed. Often referred 
to as an “EVA parachute” it mitigates one of the major risks of EVA operations, that of 
becoming separated from the spacecraft. 


Space Rescue is currently primarily “ self -rescue ” 
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There are many factors which make rescue of one spacecraft by another very difficult, 
given the current state of human spaceflight technology. This forces space rescue to 
primarily be a “self-rescue” type of operation although rescue by other vehicles is 
possible in certain circumstances. 

This problem of rescuing one spacecraft by another is determined by the characteristics 
of the spacecraft in distress and the rescue spacecraft. The rescue task is made 
increasingly easier if the spacecraft in distress can maintain human life for a longer 
period of time. The rescue task is also made easier the more rapidly a rescue craft can be 
prepared for launch. Finally the rescue task is made easier the fewer the limitations on 
launch of the rescue vehicle (weather, systems, orbital mechanics). 

Given these characteristics, rescue scenarios are optimized when a spacecraft in distress 
can dock with another vehicle that can provide life support while waiting for a rescue 
vehicle and where the rescue vehicle can be rapidly prepared and launch into the same 
orbit as the spacecraft in distress. 

The successful response to the famous Apollo 13 explosion was made possible by the 
fact that the Apollo Command Service Module, which suffered the explosion, was 
docked to the Lunar Module (another spacecraft) which supported life long enough until 
the crew could use the limited capabilities of the Command Module to return to earth. 
Even though two vehicles were involved, this can clearly be seen as a case of “self- 
rescue”. 

In current Low Earth Orbit (LEO) operations, survival in a contingency can be extended 
by docking to the International Space Station (ISS). This is only possible when the 
spacecraft in distress can maneuver to rendezvous and dock to the ISS. Orbital mechanics 
may limit the ability of the spacecraft in distress to perform this maneuver. If the 
spacecraft in distress is not already in an orbit planned for rendezvous with the ISS, then 
this is unlikely to be possible. 

One of the questions asked after the loss of the shuttle orbiter Columbia has been whether 
or not the Columbia’s crew could have sought safe haven aboard the ISS. Reviewing this 
case is instructional regarding the difficulties of space rescue. Columbia did not carry a 
docking port for the ISS, nor did it carry full spacesuits for each crewmember. Solutions 
could have been developed for each of these problems by stationkeeeping the orbiter near 
the ISS and transferring the crewmembers using the station and shuttle robotic arms. The 
Launch Escape Suits (LES) (the orange suits worn by shuttle crews for launch and return) 
do have a limited capability in vacuum and crewmembers in these suits could have been 
carried between the orbiter and the space station by astronauts in regular spacesuits. 

As problematic as these solutions are, they are simple to solve in comparison to the 
problems of Columbia actually reaching the ISS on its last flight. In order to maximize 
scientific payload, Columbia’s last flight was launched into an orbit at a 39 degree 
inclination to the equator. The ISS orbits in an orbit inclined 51.6 degrees to the equator. 
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To shift the orbit 2 degrees in inclination would take almost all of the orbital 
maneuvering fuel onboard the orbiter. So even if practical solutions existed for the 
transfer of crew between vehicles, there was no way for Columbia to have even 
maneuvered anywhere near the orbit of the ISS. 

An optimal rescue vehicle is one that can be rapidly prepared for launch and has few 
limitations on the conditions for launch. The Soyuz vehicle is by this metric, a very good 
rescue vehicle because the vehicles and their launchers are in a production line and the 
launchers are capable of launching in a wide range of weather conditions. The Space 
Shuttle is less optimal by this metric because the turn-around time vary based on 
discoveries in post-launch inspections and the weather limits on launch are more 
restrictive than Soyuz. There are other metrics to consider however. Where Soyuz must 
be launched with at least one crewmember and is capable of returning three, the shuttle 
can be launched with three-four crewmembers and return 7 nominally and a larger crew 
in a contingency. It would require 3 Soyuz flights to return to earth the numbers of 
crewmembers that can be carried in a single shuttle in a contingency. 

Current launch rates and the ability to launch on time make it difficult to implement a 
rescue launch capability to spacecraft with a short mission life except where measures are 
taken to prepare a rescue mission prior to the launch of the first or primary mission. 

For example the United States has gone to significant measures following the Columbia 
accident to maintain a rescue flight capability in case an orbiter is stranded in orbit. This 
essentially makes it necessary to prepare two missions whenever one is launched, the 
primary mission as well as the rescue mission. As a practical matter, the rescue mission is 
not usually completely prepared before the launch of the primary mission. Techniques 
have been developed to allow the rescue mission to only be partially assembled before 
the launch of the primary mission. 

In particular, the shuttle rescue mission capability is based on the preparation of the next 
regularly scheduled shuttle mission. A rescue mission is considered “ready” when the 
number of days to complete launch preparations of the rescue mission on a highly 
expedited schedule is less than the maximum number of days that the space station 
could support life for the normal space station crew and the space shuttle crew who 
would be seeking a safe haven aboard the space station. In this way the space station 
serves as a place for the crew of a damaged shuttle to dwell while waiting for a rescue 
launch. Although there are two ports on the space station capable of shuttle docking, 
mechanical interference prevents two orbiters from being docked to the space station 
simultaneously. Therefore if a shuttle crew is seeking a safe haven in the international 
space station, the orbiter in which they arrived must be jettisoned while it still has enough 
electrical power and fuel to successfully undock and maneuver out of the way of the 
space station. This automated departure procedure required technique development to 
allow the orbiter to be disconnected with the entire crew onboard the ISS. 

The Russian Soyuz vehicle is more suitable as a rescue vehicle for a space station based 
crew than the Space Shuttle for several reasons. First once a Soyuz crew is on the station, 
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they can dwell there for some time. The basic Soyuz vehicle has an on-orbit lifetime of 6 
months versus the 14-19 days of the Space Shuttle so it is possible to keep a Soyuz at the 
space station continuously by launching a new Soyuz every 6 months and using the older 
Soyuz on the station to rotate a crew to earth. While the Soyuz is at the station, it is 
available for rapid (45 minutes) activation and emergency return of the crew. The Soyuz 
launch vehicle is capable of launching under a much wider range of weather conditions 
than the shuttle increasing the availability for a rescue launch. The major limitation on 
the Soyuz as a rescue vehicle is crew size. As a crew return vehicle for a 3 person ISS 
crew, the Soyuz is very near an optimal solution. However if a shuttle were stranded at 
the ISS, with seven crewmembers onboard, it would take 4 Soyuz flights (Launched with 
only one crewmember) to return all seven crewmembers to earth. This would be a 
tremendous amount of hardware to be readied and launched to accomplish this rescue 
mission. 

It is worthwhile to note that when multiple vehicles are required to rescue the entire crew 
that the Probability of the entire crew survival is defined by 

p — 1Q_f1Q_P VI Q_ (p \flightsrequired \ 

1 entirecrewsurvival ' v 1 ’ primarysuccess / V 1 • K 1 rescuesuccess ) ) 

So as the number of rescue flights to bring the entire crew home rises, so must rise the 
reliability of each individual rescue flight in order to meet the same probability of entire 
crew surviving. This can really cause a complexity increase in the rescue vehicle and is 
the reason that for the proposed United States Crew Return Vehicle (CRV) for the ISS 
that a single vehicle was equipped to return the entire seven person crew of the ISS. 

Limitations of Ground Based Rescue 

The fundamental issue with a ground based rescue is the limitations on its use. First, the 
rescue mission must be able to be launched within the available life support capability of 
the stranded spacecraft. The time required to prepare a mission as well as the possibility 
of a mission scrub due to systems failure or weather significantly reduces the 
effectiveness of this type of rescue option. These limitations may be major, as in the case 
of the shuttle, or minor as in the case of the Soyuz. 

Launch sites for the rescue mission must be able to reach the orbits of the stranded 
vehicle. The minimum inclination that can be reached by a launch site is determined by 
the launch site’s latitude. This is due to the limitation of basic orbital mechanics that 
requires the center of the earth to be at the center of an orbit. Because of this, a launcher 
can never launch into an orbit at lower inclination than the latitude of the launch site. 

This significantly limits rescue options. For example, when NASA launches a Hubble 
Space Telescope maintenance mission to a 28.5 degree inclination orbit, it is impossible 
for Russian launch vehicles to be of assistance because the latitude of the Russian launch 
sites are so much farther north that they can never achieve a 28.5 degree inclination orbit. 
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Orbital mechanics also significantly limits the number of launch opportunities to perform 
a rescue. Normally for rendezvous with objects in low earth orbit, the number of launch 
opportunities a day is limited to two relatively short windows from a single launch site. 

The tougher question is whether or not a failure that strands one spacecraft on-orbit is 
also likely present in an identical rescue spacecraft. If the hazard that caused the first 
crew to be stranded on-orbit is present in an identical rescue vehicle, then launching the 
rescue flight may result in additional crewmembers stranded on-orbit if the hazard also 
disables the rescue spacecraft. This has been a major question when considering the use 
of shuttle vehicles to rescue another shuttle stranded at the ISS due to ascent debris 
damage. If ascent debris has disabled the first vehicle at the ISS, then the possibility 
exists that a rescue flight could be disabled by a similar debris strike. 

This is not just an issue for the spacecraft systems but also for the launcher. It is 
interesting to note that the Soyuz launcher is used for both human launches and cargo 
launches. There have been cases where a malfunction in a cargo launch has caused a 
temporary grounding of the Soyuz launcher for human as well as cargo flights. 

This question is especially problematic for the space shuttle. Given the short time that he 
space shuttle can dwell at the space station, it places the space shuttle managers in a 
difficult posture. In the 14-19 day on-orbit life of the orbiter at the station, if there is 
serious damage to the orbiter they must evaluate the risk of the debris on the rescue flight 
and decide whether to commit to returning the crew in the damaged/repaired orbiter or 
decide to jettison the damaged orbiter while it still has power/propulsion in order to clear 
the way for a rescue flight. 

Another major problem with ground based rescue is the problem of docking with a 
spacecraft that is tumbling. The United States demonstrated the ability to rendezvous and 
capture spacecraft spinning about a single axis on a number of occasions (Solar 
Maximum satellite, the Westar and Palapa rescues, the Intelsat Syncom Rescue) however 
docking with a tumbling spacecraft is a much more difficult task. 

Simulations conducted during the X-3 8/Crew Return Veicle (CRV) project showed that it 
is much easier to escape from a tumbling spacecraft with a crew escape type of vehicle 
rather than to approach and dock with it. In particular large appendages, such as solar 
arrays, radiators and antennae) sweep out a large volume when a spacecraft is tumbling. 
This volume becomes a ”keep-out’ ’ zone for any rescuing spacecraft attempting to fly to 
and dock to the tumbling spacecraft. As the rescuing spacecraft approaches a tumbling 
spacecraft with complex geometries it becomes very difficult to determine if the rescuing 
spacecraft is even in a location where a safe approach path exists to the tumbling 
spacecraft. 

In contrast escaping from tumbling spacecraft in a rescue craft that is initially docked 
with the rescue spacecraft is a much easier problem. The geometry is fixed. The rescue 
spacecraft is at a known orientation with regard to the body coordinates of the tumbling 
spacecraft. Given the appendages that are part of the tumbling spacecraft, it is possible to 
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compute a trajectory that leads to clearance from the appendages with usually three 
propulsive maneuvers of achievable magnitude. In a large number of simulations with a 
mix of pilot and non-pilot astronauts it was demonstrated repeatedly that escaping from a 
docking port on the bottom of the ISS was relatively easy to do with a CRV even with 
the ISS tumbling at up to 5 degrees/second. The 5 degrees a second was established as a 
reasonable loss of control limit because it was determined that this was the amount of 
rotation that would occur if a single propellant tank on the ISS lost all of its contents in a 
single propulsive impulse. 

Because the difficulties of ground based rescue explained in this chapter, the ISS 
Program Office chose to implement a space based self-rescue system, the CRV. This was 
initially planned to be first provided by the Russian Soyuz and then implemented with a 
US developed CRV. As history has developed, the CRV has been canceleld and the 
Russian Soyuz has filled this role for the ISS. 

The Crew Return Vehicle as a Study in Space Rescue 

Because the CRV was the first custom built space rescue vehicle it is worthwhile to 
examine its development and its driving requirements in order to understand the desirable 
characteristics and rationale for any future space rescue system. 

Following the Challenger accident in 1986, the Space Station Freedom Program (as it 
was known at the time) baselined an Assured Crew Return Vehicle (ACRV). This vehicle 
was to meet three basic missions 

The first mission was to return the crew if a crewmember(s) became ill or injured while 
the space shuttle orbiter was not at the station. 

The second mission was to return the crew in the event that a catastrophic failure of the 
station made it unable to support life and the space shuttle orbiter was not at the station or 
was unable to reach the station in the required time. 

The third mission was to return the crew in the event that a problem with the space 
shuttle made it unavailable to resupply the station or changeout crew in a required 
timeframe. 

Prior to the baselining of an ACRV, the Space Station Freedom had baselined an onboard 
health facility to deal with astronaut health emergencies ad a “safe haven” capability to 
deal with failures aboard the station. Significant architectural modifications were 
incorporated in the Space Station Freedom design to make safe haven a possibility. For 
example, the modules of the Space Station were arranged in an elliptical “racetrack” 
pattern. This precluded the possibility of a failure in one module making other modules 
inaccessible as well as ensured that there were two exits from every module. The 
subsystems of the Space Station Freedom design were also distributed that loss of any of 
the racetrack modules did not disrupt any critical services. 
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The baselining of the ACRV occurred with significant trepidation. The concern was that 
a adding another full spacecraft to the Space Station Freedom would significantly 
increase the development and cost risk to the program. It is important to note that the 
requirement was baselined without any increase in the expected cost to complete of the 
Space Station program. When the Space Station Freedom evolved into the International 
Space Station (ISS), the United States committed in an international Memorandum of 
Understanding to produce the ACRV while Russia committed to providing CRV 
capability with its Soyuz vehicle during the initial ISS operations. Once again, no 
resources were committed to the ACRV development but rather the ACRV was viewed 
as a threat to the ISS budget. 

From 1986 to 1995 there were 12 different attempts to define an ACRV configuration. 
While significant work was done to refine the requirements for the vehicle, limited 
progress was made in actually starting a full development. Without an agreed to budget 
for the project, each attempt foundered over concerns over development cost. A wide 
range of options were studied during this time ranging from Apollo type capsules to 
biconic vehicles to lifting bodies to a mini-shuttle orbiter and consideration was even 
given to building an entire additional shuttle orbiter so that one could be continuously 
located at the station. In all of these concepts, test verification was a major cost driver in 
the program. 

In 1995 the final and most long lived of the CRV projects was started. The X-38/CRV 
project would run from 1995-2002. It was based on using a lifting body with a detachable 
propulsion unit. The propulsion unit would maneuver the craft away from the ISS and 
provide a deorbit maneuver. The propulsion unit would then be jettisoned and the lifting 
body would fly back to earth much in the same manner as an orbiter. At the end of the 
flight a large parafoil would be deployed to allow landing at low velocities (35 knots) and 
at slow descent rates (25 fps) on a wide variety of desert type terrain. 

This X-38 project conducted over 40 development tests of the large parafoil with 
conventional airdop techniques. The project also conducted 8 free flight tests of the 
lifting body/parafoil combination by dropping the lifting body from the wing of NASA’s 
B-52 bomber. On the final flight of the X-38 project, the lifting body intercepted the 
trajectory of a CRV returning from space at approximately 50,000 feet and flew the 
trajectory successfully to large parafoil deployment at 15,000 ft. The world’s largest 
parafoil (7500 square feet) then deployed and flew the vehicle to a precision touchdown 
within 150 ft of the planned target. This accuracy was obtained while dropping from the 
B-52 close to 10 miles from the intended launch point. Steering winches on the lifting 
body allowed it to manipulate the parafoil for precision approach and landing. 

A space test vehicle which was to be carried aloft by the Space Shuttle was over 75% 
complete at the time of project cancellation. Structural and systems tests conducted after 
the project cancellation showed that the design would have passed NASA requirements to 
fly in the shuttle bay and that its systems were capable of completing a vehicle return 
mission, 
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At the time of cancellation of the X-38 project it was projected that a fleet of 3 vehicles 
could be built and fully qualified for approx $1.5 billion. This would have resulted in a 
dramatic decrease in the cost to produce a CRV which according to previous NASA cost 
models would have cost over $3 billion to develop alone. They key to the reduced cost to 
develop this vehicle was in its verification approach which used a build-up method 
similar to modern aircraft testing for the atmospheric flight phases. The basic lifting body 
shape was a modified version of the X-23/X-24 shape that the United States Air Force 
had flown to space and in the atmosphere in the 1970s. This served as the basis for the 
design and this part of the design, although modified for the CRV role, was in many ways 
“pre-tested” before the start of the program. Parafoil only flight were conducted to 
qualify the parafoil system. (For reference, the parafoil system was the largest square 
parachute in the world with a deployed wing area 50% bigger than that of a Boeing 747.). 
Then flights utilizing the lifting body/parafoil combination in the earth’s atmosphere 
were conducted. Components of the X-38/CRV were tested onboard the Space Shuttle 
(inertial-Global positioning system navigation system) and NASA’s F-15 
(electromechanical flap actuator) in order to qualify them for flight. Then a full set of 
ground tests and a space flight test were to be conducted. This build-up approach was a 
significant factor in reducing the number and costs of testing the CRV. 

There were several technology firsts in the X-38 CRV. In addition to the world’s largest 
parafoil and the first new lifting body shape (modified X-23/X-24) flown in 20 years, the 
X-38 incorporated the following new technologies: 

• Flush air data system for angle of attack and sideslip tied directly into 
the flight control system 

• Neural Network for computing angle of attack and sideslip from flush 
air data system 

• Laser initiated pyrotechnics 

• Electromechanical actuators for full authority flight control surfaces 

• Hot structures for nosecap and body flaps 

• Dynamic Inversion flight control laws 

• Electromagnetic International berthing Docking Mechanism 

• Large space qualified Lithium-Ion batteries 

The X-38/CRV represented the first attempt in space technology to build a complete 
spacecraft dedicated to the rescue/escape role. Future space rescue vehicles may or may 
not incorporate the technologies pioneered in this project. The requirements developed by 
the project to drive this design are more instructive than the actual technologies involved 
because they represent the first clear statement for what a rescue spacecraft designed 
from a “clean sheet” of paper would need to be. 

There were thirteen major requirements identified for the crew return vehicle. As further 
definition occurred the medical community did an extensive review of what would be 
required for a “space ambulance” and identified additional requirements. The thirteen 
major requirements are identified in the following table 
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Requirement 

Rationale 

Operate in a shirtsleeve environment 

Crew might not have the time nor the 
physical ability to get into a spacesuit 

Dual fault tolerant in critical systems 

Necessary for human rating 

Landing within a 5 NM radius 

Minimize search and rescue time 

Dry land touchdown 

Deconditioned crewmembers may have 
trouble in ocean survival situation, Avoid 
the need for ocean recovery forces. 

Supports medical mission 

To be an ambulance an injured 
crewmember must be able to 
ingress/egress, must contain medical 
equipment, get injured crewmember to care 
in 24 hours. 

Less than 4g sustained load inflight 

Support deconditioned injured 
crewmember 

7 crewmembers of 95% American male 

Bring the entire crew down in a single 
flight 

All attitude separation 

Able to perform function even if ISS has 
lost attitude control 

Separation in less than 3 minutes 

Able to perform function rapidly in case of 
a growing catastrophe onboard the ISS 

Two way communications with the ground 

Ability coordinate rescue 

Autonomous capability - pilot not required 

Surviving crewmembers might not bepilot 
trained 

Operation in English 

US provided system 

3 year life with 95% availability 

Minimize costs associated with launch of 
replacement units 


Deconditioning occurs in crewmembers after they have been in nmicrogravity condition 
on-orbit. Deconditioning starts to happen almost immediately on-orbit although 
significant symptoms only occur as the mission increases duration. Current constraints 
place a maximum duration shuttle flight at 19 days due to effects of deconditioning. 

It is interesting to examine how the medical community expanded the requirements to 
turn the CRV into the world’s first “space ambulance”. They identified a specific set of 
equipment to be carried onboard and a set of vehicle capabilities that were unique to the 
rescue ambulance role. 

In terms of medical equipment, the medical community identified the following 
capabilities and equipment: 

“The CRV shall accommodate medical life support for one ill or injured crew member 
including, but not limited to: ventilation, physiological monitoring with defibrillation, 
intravenous fluid therapy, and pharmacotherapy services. 
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CRV Emergency Medical Kit (16 in x 15 in x 10 in or 2400 cubic inches at 30 lbs) 

- Bandages, Equipment, and Meds (1080 cubic inches at 20 lbs) 

- Pulse Oximeter (50 cubic inches at 1.2 lbs) 

- Intravenous Fluids Pump (200 cubic inches at 3.0 lbs) 

- Suction Device (14 cubic inches at 0.5 lbs) 

- 2 liters IV fluids (200 cubic inches at 4.4 lbs) 

- Ambubag (250 cubic inches at 0.9 lbs) 

CRV hard mounted medical equipment (1200 cubic inches at 24 lbs) 

- AED defib/monitor (768 cubic inches at 17 lbs) 

- Autovent Ventilator/Respiratory Support Pack (432 cubic inches at 7 lbs) 
Totals 3600 cubic inches at 54 lbs “ 

Most interesting to the vehicle designer was the implications of these capabilities on 
vehicle design. The X-38/CRV team spent a considerable amount of time assuring 
themselves that defibrillating someone in a metal spacecraft cabin would not result in 
hazardous currents to any other crewmember. Physiological monitoring, ventilation and 
intravenous fluids all required special accommodations in the vehicle design. 

The medical community also identified a minimum survival kit for inflight and 
postlanding survival. This included the following requirement: 

“The CRV System shall provide a minimum of 24 hours of crew survival equipment and 
consumables including, but not limited to: 

Survival kits for 7 crewmembers 

- Clothing, shelter, hygiene, and rations 
Potable Water 

- 10.5 liters (7 x 1.5 liters fluid loading) 

- 7.0 liters (7 x 1.0 liters for 24 hrs survival) 

(17.5 liters = 17.5 kgs = 38.5 lbs)” 

Fluid loading refers to the procedure of having crewmembers drink significant amounts 
of water prior to entry to prevent blood pressure drops when they are back in an earth 
gravity environment. 

The medical also placed requirements on the design which required the crew to be in a 
prone position at landing. 

The medical also put some challenging requirements on the life support system designer. 
First in order to accomplish the ambulance function, the medical community required the 
ability to place an injured crewmember on 100% oxygen (4 lbs/hr) during the entire 
CRV flight. This was a problem for the life support designer because when a human is 
breathing 100% oxygen, their exhalation contains significant oxygen. In a small vehicle 
this can rapidly lead to an environment of increased flammability. The CRV was 
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designed to be equipped with nitrogen tanks and computer controlled valves to dump part 
of the atmosphere overboard and repressurize with nitrogen to keep the inside of the 
cabin within flammability limits. Given the small volume of the CRV this limit could be 
quickly reached with a crewmember on 100% oxygen. 

The second challenging requirement from the medical community for the life support 
designers was the requirement to purge the CRV atmosphere. The medical community 
pointed out that one of the main scenarios for a CRV use would be a fire aboard the ISS. 
In this case the CRV atmosphere could be contaminated with smoke and combustion 
products before the hatch was closed. The life support system was provided with the 
ability to changeout the atmosphere as well as activated carbon filters to scrub the 
atmosphere. 


Safe Haven 

The final subject to be covered in space rescue is that of safe haven. When a crew in 
space is in trouble, the longer they can survive provides a longer time to prepare a rescue 
mission, significantly increasing the probability of success. On long duration missions to 
the Moon and Mars, safe haven technology may be the only rescue capability available to 
the crew. 

Following the Columbia accident, NASA decided a Contingency Shuttle Crew Support 
(CSCS) capability onboard the ISS. Prior to every shuttle launch a computation is made 
of how long the ISS could support its nominal crew along with the shuttle crew. In order 
to have a rescue capability, the rescue shuttle would have to be able to be readied for 
flight on an expedited basis in less days than the maximum capability of the ISS to 
support the lives of the station and the shuttle crew. 

NASA’s experience on this is instructive. Although it may seem like a simple task to 
compute the maximum life support capacity of the ISS, several questions immediately 
come up as bounding assumptions. These include: 

• What assumptions should be made on equipment failure rate ? 

• What assumptions should be made on equipment lifetime ? 

• Should hardware that is installed on the ISS but not yet exercised be 
counted as part of the capability ? 

• Should nominal food, water and exercise (oxygen) consumption be 
planned or should a reduced consumption rate be assumed ? 

• Should resupply of the ISS on normal schedules with non-shuttle assets 
(Russian Progress/Soyuz) be assumed ? 

• Should it be assumed that 3 crewmembers would be immediately 
evacuated from the station using the Soyuz to decrease the overall life 
support requirement ? 
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In the end, NASA made the decision to compute three separate estimates. One estimate is 
based on the entire ISS and shuttle crew remaining aboard the station, being resupplied at 
nominal rates and consuming at nominal rates. When examining this number it is 
recognized that this assumes perfect hardware and resupply perfonnance but that there is 
also some reduction in requirement that can be made by reduced food, water and oxygen 
(exercise) consumption. A second estimate, called the engineering estimate, assumes a 
failure rate of hardware consistent with recent experience. For example when the water 
electrolysis device on ISS, which generates oxygen, had a high failure rate, then 
engineering estimates included it as an already failed component. . A third estimate called 
worst case failure case assumed the worst possible failures to generate the minimum life 
support capability of the ISS. All three of these estimates are briefed at the flight 
readiness review and the engineering estimate is compared to the number of days 
required to prepare a rescue shuttle before the launch of a primary shuttle mission begins. 


Conclusions 

Space rescue is in its infancy as a technical capability. Given that it is likely that human 
spaceflight will remain the riskiest of human flight endeavors for the foreseeable future, it 
is likely that much more work will need to be done in this field. In this chapter we have 
reviewed the attempts to put together space rescue capabilities from operational 
capabilities as well as attempts to design a custom space rescue system. 
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